Wp Sqaured
Monthly
Arbitrary Perl code execution in cPanel and WP Squared via insufficient validation of the plugin parameter in the create_user plugin, allowing any authenticated user to execute arbitrary Perl code as their underlying system user account. Vendor-supplied CVSS 4.0 rates this Medium (5.3) with PR:L confirming authentication is required, while SSVC simultaneously rates Technical Impact as total - a notable discrepancy defenders should note. No public exploit has been identified and CISA has not added it to KEV; WebPros released patches across all affected branches on May 8, 2026.
Arbitrary Perl code execution in cPanel and WP Squared via insufficient validation of the plugin parameter in the create_user plugin, allowing any authenticated user to execute arbitrary Perl code as their underlying system user account. Vendor-supplied CVSS 4.0 rates this Medium (5.3) with PR:L confirming authentication is required, while SSVC simultaneously rates Technical Impact as total - a notable discrepancy defenders should note. No public exploit has been identified and CISA has not added it to KEV; WebPros released patches across all affected branches on May 8, 2026.